CVE-2026-73570

This is a weakness in Zimbra that can allow an attacker on the network to trick the system into running commands on the server. The risk is much higher if you installed the optional SNMP add-on and turned on SNMP notifications, because the notification handling process can be abused. Think of it like a door in your building that’s usually for delivery updates—but if configured a certain way, a bad actor can use it to unlock the back office computer and run their own commands.

This matters if you run Zimbra Collaboration (ZCS) and your deployment includes the optional zimbra-snmp package with SNMP notifications enabled, and your version is before 10.1.20. It is specifically a remote risk tied to how SNMP notifications are processed, so exposure depends on your configuration and whether the attacker can reach the relevant interface. If SNMP notifications aren’t enabled or zimbra-snmp isn’t installed, the scenario described in the advisory does not apply; otherwise, treat it as an internet-facing risk if your Zimbra services are reachable from outside your network.

This is RED because it is confirmed by CISA to be exploited in the real world (CVE-2026-73570 is listed in KEV). CISA requires remediation by 2026-08-24, and the vulnerability can allow remote attackers to execute commands on the Zimbra server when the SNMP add-on and notifications are enabled.

Confirm exposure (owner/IT checklist)

1. Identify the running product/version: confirm you are running “Collaboration” / “Zimbra Collaboration Suite” and note whether it is before 10.1.20.
2. Confirm zimbra-snmp presence: check whether the optional zimbra-snmp package is installed on the Zimbra host.
3. Confirm SNMP notifications are enabled: review your Zimbra/SNMP settings to determine whether SNMP notifications are turned on (the vulnerability requires both zimbra-snmp and SNMP notifications).
4. Confirm reachability: determine whether your Zimbra services handling this behavior are reachable from the internet or untrusted networks.

Patch / upgrade (primary fix)

• Upgrade Collaboration to the vendor fixed release: 10.1.20.
• Treat 10.1.20 as the minimum fixed version; if you already run a later release, verify you are on/above 10.1.20.

Temporary mitigation if patching is delayed

• Disable SNMP notifications and/or remove/disable the optional zimbra-snmp package according to Zimbra’s security instructions.
• After the change, re-check that SNMP notifications are actually off and that zimbra-snmp is no longer active.

CISA timing

• CISA KEV remediation due date: 2026-08-24.

What to monitor during/after remediation

• Review Zimbra server logs around the period of exposure for unexpected process execution, unusual command activity, and abnormal email/SNMP-related events.
• Watch for persistence behavior (new scheduled tasks, unexpected binaries/scripts) on the Zimbra host, especially if SNMP notifications are enabled until the upgrade is complete.
• If there are any indicators of compromise, escalate to incident response immediately and preserve logs for triage.

CVE-2026-73570 is a remote code execution vulnerability (CWE-78) in Zimbra Collaboration (ZCS) affecting versions before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. The mechanism is improper sanitization of untrusted input during SNMP notification processing, which can allow an unauthenticated attacker to trigger execution of arbitrary operating system commands as the Zimbra user.

Exploitation status: CISA KEV lists this CVE as exploited in the wild (added 2026-08-21) with a remediation due date of 2026-08-24, and the traffic-light verdict is RED. No public exploit code was found in the provided sources, and EPSS is reported as a low predicted likelihood with a flat trend; however, KEV/real-world exploitation takes precedence for urgency. KEV meaning here: it indicates CISA has high confidence exploitation is occurring and mandates action aligned with CISA’s prioritization/triage and forensics guidance.